To update your Synology NAS for security alerts and patch vulnerabilities (such as recent PHP2Shell or DSM flaws), follow the step-by-step instructions below.
Phase 1: Prerequisites & Preparation
- Back Up Data: Ensure your critical data is backed up to an external drive or cloud storage before proceeding.
- Check Current Version: Log in to your Synology DSM interface with an account belonging to the administrators group.
Phase 2: Updating DSM (DiskStation Manager)
- Open Control Panel.
- Click on Update & Restoration.
- Under the DSM Update tab, check if a new version is available.
-
- If a minor update or important security fix is available, click Download or Update Now.
- Tip: Click Update Settings and configure your system to automatically install important updates to stay protected.
-
Phase 3: Updating Vulnerable Packages (e.g., PHP and Web/Server Packages)
If security advisories mention specific packages (such as PHP, WordPress, Web Station, MailStation, or others):
- Open Package Center.
- Go to the Installed tab.
- Search for PHP or any affected packages (e.g., Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress).
- Click Update next to the outdated package.
-
- Note: Packages dependent on PHP will usually restart automatically, though MailStation may require a manual update inside Package Center.
- If your DSM version is prior to 6.2 and a patch is unavailable, temporarily disable the affected packages to reduce exposure.
-
Proactive Troubleshooting & Common Issues
- “Not Secure” Browser Warning: If you see a security warning when logging into DSM, go to Control Panel > Security > Certificate, click Settings (or Configure), and ensure the proper domain certificate is assigned to the system default service. [1]
- Manual Update Requirement: If automatic updates fail or your model is offline, download the
.patupdate file directly from the Synology Download Center and upload it manually via Control Panel > Update & Restoration > Manual DSM Update. [1]